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Clock synchronization for nonfaulty processes in multiprocess networks is indispensable for a 
variety of technologies. A reliable system must be able to resynchronize the nonfaulty processes 
upon some components failing causing the distribution of incorrect or conflicting information in the 
network. The task of synchronizing such networks is related to detectable Byzantine agreement 
(DBA), which can classically be solved using recursive algorithms if and only if less than one-third 
of the processes are faulty. Here we introduce a nonrecursive quantum algorithm that solves the 
DBA and achieves clock synchronization in the presence of arbitrary many faulty processes by using 
only a single quantum system. 


Introduction . - In many multiprocess networks, includ¬ 
ing data transfer networks, telecommunications net¬ 
works, and the global positioning system, the individual 
processes need to have clocks that must be synchronized 
with one another [1, 2]. To this purpose, individual pro¬ 
cesses’ clocks must periodically be resynchronized. This 
motivates the need for clock synchronization algorithms 
which work despite the faulty behavior by some of the 
processes. Faulty behavior can occur due to a variety of 
causes, including crashing, transmission failure, and dis¬ 
tribution of incorrect or inconsistent information in the 
network [3]. A clock synchronization algorithm should 
achieve the following tasks: Cl) For any given instant, 
the time of all nonfaulty processes’ clocks must be the 
same. This is necessary, but not sufficient, since simply 
stopping all clocks at zero satisfies Cl. We therefore need 
to assume that a process’ logical clock also keeps the rate 
of its corresponding physical clock. In addition, synchro¬ 
nizing may cause further errors, so we require that: C2) 
There is a small bound on the amount that a process’ 
clock is changed during synchronization [4]. 

Reliable clock synchronization algorithms can be com¬ 
plicated. To simplify the problem we shall work under 
the following assumptions [4]: Al) Initially, all clocks are 
synchronized to the same value. Physical clocks typically 
do not keep perfect time but drift to respect one another. 
This motivates the following assumption: A2) All non¬ 
faulty processes’ clocks run at one second in clock time 
per second in real time. A general problem arises from 
the clocks continuously changing during the synchroniza¬ 
tion procedure. Unless the synchronization algorithm is 
very fast, this will cause problems. This motivates our 
last assumption: A3) A nonfaulty process can read the 
time difference between the clock of another process and 
its own. 

A method to achieve synchronization is to use interac¬ 
tive consistency algorithms (ICAs) in which all nonfaulty 
processes reach a mutual agreement about all the clocks 
[4]. A ICA should satisfy that, for every process p: (1) 
Any two nonfaulty processes obtain the same value of 
process p’s clock, even if p is faulty. (2) If p is non¬ 


faulty, then every nonfaulty process obtains the value of 
p’s clock.quit 

The conditions for ICAs make them suitable for the 
task of fault tolerant synchronization. For most ap¬ 
plications it is sufficient to consider a scenario called 
detectable Byzantine agreement (DBA) or detectable 
broadcast [5, 6]. In this case, it is required that: (i) ei¬ 
ther all nonfaulty processes obtain the same value or all 
abort, and (ii) if process p is nonfaulty, then either ev¬ 
ery nonfaulty process obtains the same value or aborts. 
By “abort” we mean treating the value as undefined and 
exiting the protocol. 

Classical ICAs can only achieve fault tolerant synchro¬ 
nization through DBA if less than one-third of the pro¬ 
cesses are faulty [4] and agreement is achieved by ma¬ 
jority voting using a recursive algorithm, called OM(n), 
where n is the number of faulty processes. The OM{n) 
algorithm works as follows. We label the processes as 
Pfc, with k = 1, 2,... ,m. If n = 0, then Pi distributes 
its value to every other process. Every process uses the 
value received from Pi and, in case no value is obtained, 
uses 0. If n > 0, then Pi distributes its value to every 
other process. For k = 2,..., m, let Xk denote the value 
obtained by Pfc from Pi. If Pfc receives no message, then 
let Xk = 0. Pfc acts as Pi in algorithm OM(n — 1) by 
distributing Xk to the remaining m — 2 processes. For 
every k and Vj ^ k, let Xj be the value received by Pfc 
from Pj using OM(n — 1), and in case no value was re¬ 
ceived Xj = 0. Pfc decides on the value obtained from the 
median of (aq,..., x m ). Thus, OM(n) requires 0(m n+1 ) 
transmitted messages to solve the task. 

The DBA is an example of a communication task for 
which quantum resources can provide a solution, while 
classical tools cannot. Nevertheless, the sepcial case of 
DBA in a three process network where one is faulty, 
has been solved using quantum methods based on three- 
qutrit singlet states [5, 7], four-qubit entangled states 
[8, 9], and three [6] or two [10] pairwise quantum key 
distribution (QKD) channels. 

Interestingly, later works have shown that there are 
quantum solutions for certain communication complexity 
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problems and secret sharing tasks which do not require 
entanglement, but, instead, sequential communication of 
a single quantum system [11, 12]. These protocols have 
been shown to be much more resistant to noise and im¬ 
perfections, and significantly more scalable than proto¬ 
cols based on entanglement. 

In this paper, we introduce a quantum ICA that solves 
the DBA and achieves clock synchronization in the pres¬ 
ence of an arbitrary number of faulty processes, with only 
one single round of message passing per process indepen¬ 
dently of the number of faulty processes, utilizing only a 
single quantum system. 

In order to solve the DBA problem, the to processes 
need to share data in the form of lists Ik, of numbers sub¬ 
ject to specific correlations, and the distribution must be 
such that the list Ik held by process Pk is known only 
by Pk- Quantum mechanics provides methods to gener¬ 
ate and securely distribute such data, here we shall seek 
for one which is simple, efficient, and easily extendible 
to an arbitrary number of processes. We assume that all 
processes can communicate with one another with oral 
messages by pairwise authenticated error-free classical 
channels and pairwise authenticated quantum channels. 

Correlated lists and their use.- The initial stage of 
the quantum protocol is to distribute lists Ik, for k = 
1,..., to, each of them available only to process Pk- All 
lists have to be of the same length L and are required to 
satisfy the property that if iV = 0 (or 1) is at position j 
in li, then 0 (respectively, 1) is at position j in lists Ik for 
k = 2, ... ,to (i.e., they are perfectly correlated). How¬ 
ever, if N £ {2,..., to — 1} is at position j in l\, then the 
sum of numbers at positions j in lists Ik for k = 2,..., to 
equals to — TV, and all elements in these lists are either 0 
or 1. Given an N , all the possible combinations of binary 
numbers satisfying the condition are uniformly probable. 

Note that, on one hand, Pi has information about at 
which positions the lists of all other processes the values 
are perfectly correlated, and at which positions they are 
random bits, with the property that their sum is anti¬ 
correlated with the value, N > 1, in Ik- On the other 
hand, the holder of one the lists Ik, with k = 2 ,m, 
has no information whatsoever on whether the lists are 
correlated at a given position or not. 

Once the processes have these lists, they can use them 
to achieve mutual agreement and solve the DBA by ap¬ 
plying the algorithmic part of the protocol, which we 
shall call QB{n,m). The special case, QB( 1,3), repro¬ 
duces the protocol in [9]. 

(1) Pi sends bit-valued messages to all processes. The 
message sent to process Pk will be denoted by TOp*,. To¬ 
gether with each message, Pi sends a list l\ t k of all of the 
positions in l\ in which the value rrii.k appears. If Pi is 
nonfaulty all lists and messages are identical. The full 
information which Pk receives from Pi will be denoted 
by {mi t k,h,k}- 

(2) The receiving processes Pk analyze (singlehand- 



FIG. 1 . Scheme of the quantum protocol for the distribu¬ 
tion of the correlated lists. Pi prepares a uniform d-level su¬ 
perposition state, makes a choice of basis and encoding, and 
forwards the qudit to P2 which applies a choice a basis and 
encoding and forwards the qudit to P3. Processes P3,...,P m 
act in analogy with P2. Finally P m projects the state onto 
the initial state prepared by Pi and if the outcome is 1 the 
round is treated as valid. 


edly) the obtained lists and messages. If the analysis 
of Pk shows that l\ t k is of appropriate length (i.e., about 
L/m) and {mi t k,h,k} is consistent with Ik at all posi¬ 
tions, then if Pk is nonfaulty, it conveys {mi t k,h,k} to 
all other processes Pk^i- A faulty process sends a flipped 
bit value of the message with a whatever list it chooses. 
The full information which Pj receives from Pk will be 
denoted by {mk,j, lk,j}- 

A nonfaulty Pk will also decide on the final bit value it 
adopts 14. This is mi^k, unless messages from the other 
processes force it to decide that Pi is faulty. However, 
if {mi^k,h,k} is not consistent with Ik, then Pk immedi¬ 
ately ascertains that Pi is faulty and relays to other pro¬ 
cesses neither 0 nor 1 but _L, meaning “I have received 
inconsistent data.” 

(3) Once all messages have been exchanged between 
P 2 ,..., P m , each process considers the obtained data and 
acts according to the instructions in Table I. The overall 
aim is, if Pi is nonfaulty, to have the same value of 14 
for all nonfaulty processes, or all of them aborting. 

Quantum protocol for distributing lists Ik- All pro¬ 
cesses are equipped with devices which can unitarily 
transform qudits. In addition, Pi has a source of sin¬ 
gle qudits of dimension m and the last process, P m , has 
additionally a measurement device. The protocol runs as 
follows (for an illustration, see Fig. 1): 

(I) Pi prepares the state 

1 m— 1 

m = ys £ 

V j =0 


( 1 ) 
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TABLE I. Once Pk receives all messages and lists from all other processes, it will study the obtained lists and messages and 
compare to its own list Ik- Depending on the consistency between obtained and private data Pk will act according to table 
below. Notation — 4 means that rrij^k and 4,fc are found to be consistent with Ik whereas ^ means “inconsistent 

with.” The symbol T means “I have received inconsistent data.” By M k we denote some non-empty subset of {1,..., m} \ {&}. 


(iia) 

(iib) 

(iic) 

(iid) 

(iie) 


local analysis of all data received by Pk 
Vj £ N m \ { k }, {my*,, lj,k} — Ik and all messages are equal 
Vj £ N m \ {k}, {rrij'k, lj,k} — 4 and not all messages are equal 
V .j € Mfc, {m j: k,lj,k} ¥ 4 and Vj $ M fc , {my/fe, 4',k} = 4 
V j £ M k , {Trij,k,lj,k} — h and _L Vj ^ M fc 

Vj £ Mj,, — 4, but with unequal messages, and T from Vj ^ M 


decision of Pk on the value 14 
14 = mi,*,, no faulty process 
as Pi is faulty, 14 = abort 

14 = my*,, for j ^ Mi,, as the other P/s are faulty 
14 = myfc, although Pi could be faulty 
k 14 = abort, at least Pi is faulty 


(II) Pi randomly chooses the “encoding basis” from 
to different options Uq, ..., U m -1 and labels the choice c\. 
Having chosen the ci ’st encoding basis, process Pi applies 
the following unitary transformation to the qudit: 

m— 1 

£4i = | 0 >( 0 |+ 5 > Cl |fc)<fc|, ( 2 ) 

k=1 

where u> = . From the interferometric point of view, 

applying U Cl introduces a phase-shift of —27 tci/to in the 
first beam. 

(III) After that, Pi randomly chooses a value A/ in 
the set { 0 , 1 ,..., to — 1 } and encodes IV!, by applying the 
following unitary transformation: 

m— 1 

U(Ni)=J2^ Nl \j)(j\- (3) 

3=0 

Afterwards, the qudit is sent to P 2 . 

(IV) P 2 , in the same manner as Pi, choses a C 2 € 
{0,..., to — 1} and applies a the unitary U C2 corresponding 
to choice of encoding basis. 

(V) Next, P 2 randomly chooses a value A/ in the set 
{0,1}. If N 2 = 0, no action is taken, i.e., P 2 applies 
the transformation U(N 2 = 0) = 1. If N 2 = 1, then P 2 
applies U{N 2 = 1) and then sends the qudit to P 3 . 

(VI) P 3 ,..., P m consecutively repeat the same proce¬ 
dure as P 2 with independent choices of basis and encod¬ 
ing their respective random values N 3 ,..., N m . 

(VII) In addition, P m measures the qudit using a de¬ 
vice which distinguishes the state |/>o) from any set states 
orthogonal to it. 

(VIII) If P m obtains | ^ 0 ), then the processes consec¬ 
utively reveal their encoding bases (but not their values 
Nk) in reverse order: First P m and last Pi. If it turns 
out that the sum of the basis choices modulo to equals 
zero, then the run is treated as a valid distribution of the 
numbers Nk at the same position in the private lists 4 - 

The protocol distributes the numbers in the required 
way because all the unitary operators are diagonal and, 
therefore, commute. Additionally, if Ck = 0 


mod to then 

m 

n u °>=( 4 ) 

k =1 

and, if Y^k=i Nk = 0 , modulo m, then 

m 

n w *)=!• (5) 

k —1 

Whenever this condition is not satisfied, the final state of 
the system is orthogonal to \ipo) and will therefore never 
be an outcome of P m ’s measurement. 

Clock synchronization. —Fault tolerant clock synchro¬ 
nization is one possible adaption of our method to achieve 
DBA. However, in this case, a problem arises from clocks 
ticking during the synchronization procedure. This is 
solved by exploiting assumption A3: Instead of sending a 
number, the processes send their clock differences to each 
other. In the classical case, we achieve clock synchroniza¬ 
tion by running the algorithm OM( 1) m times, sending 
clock differences instead of the binary values, and analo¬ 
gously for OM(n) [4]. In analogy with the classical case, 
the processes send clock differences also in the quantum 
case, exploiting the fact that the clock differences can be 
decomposed into binary strings up to arbitrary accuracy 
agreed upon in advance. We run QB(n,m) m times in 
such a way that for each run a new processes takes the 
roll of Pi in QB(n,m). More explicitly, P y reads the 
clock difference A xy between its own clock and the clock 
of P x . If P y is nonfaulty it will relay A xy to P z but 
if P y is a faulty process, it can arbitrarily change A xy 
before sending it. If P y relays the value obtained from 
P x to P z , then P z knows the time difference between P x 
and P y . Also, since QB(n,m ) is ran to times, P z will 
also obtain A yz from P y and thus P z knows that P y is 
claiming that the time difference between P x and P z is 
A xy + A yz , which can then be compared to A xz obtained 
directly from P x . 

Comparison with the other solutions.- The correlated 
lists needed for achieving DBA can be distributed by 
other means than with the single-qudit protocol. Suc¬ 
cessful distribution can be achieved by the process P m 
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sharing a QKD channel with every other process. P m 
uses a QKD protocol, e.g., BB84 [15] to distribute num¬ 
bers such that (1) P m and Pi share a string A'i,m = 
k\,m ■ • ■ *u,m> where K,rn £ {0, ..., m - 1} . (2) For ev¬ 
ery l = 2 ,..., m — 1, P m and Pi share a string A) m = 

Km'"Km Such that Km € {°i !}• ( 3 ) For a S iven 
j, the lists satisfy (E;=i fc i, m )modm = 0. (4) None of 
P 2 ,... ,P m -i have any information about a particular 
list element of any other process. (5) Whenever P\ re¬ 
ceives an element k{ m > 2, Pi has no information on 
the bit value of kj m for l = 2 ,..., to, and whenever Pi 

receives m = P 6 {0,1}, Pi knows that K m = p for 
all l = 2,..., to. All QKD channels except that shared 
between Pi and P m transmit bit values. In order to trans¬ 
mit elements of {0,..., to— 1} to Pi, the numbers must be 
encoded into |~log 2 (to)] qubits. One additional require¬ 
ment that has to be made for solving the DBA using the 
QKD distributed lists is that P m is not required to convey 
any lists. This is necessary since P m has full knowledge 
about the lists of all other processes and therefore easily 
could cheat. Instead, P m may announce the message it 
received from P 1; and if any inconsistency is noted by 
P2 ,... ,P m - 1, then P m will change its final value if the 
other processes convince P m of them being nonfaulty. 

There is also a number of proposed solutions to the 
DBA considering three processes where one is faulty. 
The first one, proposed in Ref. [5], relies on the three 
qutrit entangled Aharonov state. The goal is to dis¬ 
tribute lists given by all permutations of the elements 
of the set {0,1,2}, i.e., (0-1 2, 0-2-1, 1-0-2, 1 2-0, 2- 
0-1, and 2-1-0). Generalization to to parties along the 
lines of [5] would require the usage of multipartite TO-level 
entanglement, provided by the state 


|^m) 



i=cr(Sm) 


( 6 ) 


where i = {ii,...,i n }, S m = {0, - - -,to. — 1} and 
N(a(S m )) is the parity of the permutation of S m . Al¬ 
ready for the simplest case of m = 3, this approach re¬ 
quires the preparation of a very complex state which, to 
our knowledge, has not yet experimentally realized. How¬ 
ever, for the three process case, it has been pointed out 
in [10] that the distribution of the lists can be realized 
without the state (6), by utilizing two separated QKD 
channels. With small modification for the to process set¬ 
ting, distribution of the lists is achieved with to — 1 QKD 
channels. However, to encode the entire space provided 
by S m , the QKD requires |~log 2 (to)] qubits. If the ef¬ 
ficiency of a detector 77 is not perfect and the QKD is 
performed with single qubits using von Neuman mea¬ 
surements, successful distribution occurs only with prob¬ 
ability ^(m-i)ri°g2(m)l_ Typically, the classical part of 
the protocol in [5] and its possible generalizations scale 
rapidly with the number of processes. It is required that 


to! different types of lists are distributed. However, a 
solution to the three party DBA exploiting four-qubit 
entanglement provides a simpler classical part of the pro¬ 
tocol: the number of different lists is lowered from six to 
four [9], 


The general to process protocol presented in this paper 
generalizes the protocol in [9] and requires 2 m_1 different 
types of lists. As emphasized earlier, the distribution of 
the required lists can be achieved both with single-qudit 
and with to — 1 QKD channels. Using QKD channels, 
only one channel needs to transmit all elements in S m 
while the remaining to — 2 channels only transmit bit 
values. In the presence of nonperfect detectors, success¬ 
ful distribution occurs with probability rj m ~ 2+ ^ l ° S2( - m ^. 
However, in the single-qudit approach only one single 
detection is needed and, therefore, successful distribu¬ 
tion of the lists occur with probability 77 independently 
of to. The single-qudit protocol is highly scalable, both 
in terms of success probability with inefficient detectors 
and requirements on the classical lists. 

Conclusions .—We have presented a single-qudit pro¬ 
tocol which provides an efficient solution to an impor¬ 
tant multiparty communication problem: It solves DBA 
and achieves clock synchronization in the presence of ar¬ 
bitrary many faulty clocks. In principle, our quantum 
algorithm is not limited to the case of clock synchroniza¬ 
tion, it can with small modification be used for other 
tasks requiring oral message interactive consistency. In¬ 
terestingly, our algorithm works by transmitting a single 
qudit among the parties rather than by distributing a 
quantum entangled state among them. This makes the 
protocol much more practical, as single qudits can be ex¬ 
perimentally realized easily in many ways. For example, 
using unbiased multiport beamsplitters [13] or time-bin 
[14] . Compared to schemes based on several QKD chan¬ 
nels, the single-qubit protocol is more scalable and robust 
against detection inefficiencies. This results shows that 
single-qudit quantum information protocols are interest¬ 
ing beyond QKD [16-18] and random number generation 
[19, 20], and should stimulate experimental implementa¬ 
tions and further research in quantum information pro¬ 
tocols. 
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